255335 matches found
ECHO-6007-5DC2-524B
Bulletin has no description...
ECHO-8D9E-3A10-78A7
Bulletin has no description...
ECHO-2EC4-6424-5DC8
Bulletin has no description...
ECHO-E419-5755-0224
Bulletin has no description...
ECHO-5DD9-EB24-E2ED
Bulletin has no description...
ECHO-7E4D-4229-7370
Bulletin has no description...
ECHO-73AB-600D-62BE Caught by Cursor Bugbot review on PR #19827: the real vulnerability (GHSA-7xf9-4jfc-wgm4) is specific to Fine-Grained Admin Permissions V2's RealmPermissionsV2 treating manage-clients as equivalent to managing the special "admin-permissions" client, which then grants realm-wide admin power. RealmPermissionsV2 and the admin-permissions client concept do not exist in 25.0.6 — its older RealmPermissions.canManageAuthorizationDefault() has no per-ResourceServer parameter at all (it's a single, undifferentiated realm-wide check), so there is no "is this the special admin-permissions client" distinction for a narrow, upstream-faithful fix to attach to. An earlier patch here unconditionally removed MANAGE_CLIENTS from that check to close the described escalation, but that changes intended authorization behavior for every regular client's authorization management, not just a vulnerable path (upstream's real fix leaves the MANAGE_CLIENTS grant intact for non-admin-permissions clients) — reverted.
Bulletin has no description...
ECHO-2AAB-293D-53AF
Bulletin has no description...
ECHO-8C0B-1F50-633C
Bulletin has no description...
ECHO-C70D-0DFC-E7D7
Bulletin has no description...
ECHO-BD3C-E7A2-8A3A
Bulletin has no description...
ECHO-738B-62C7-508F
Bulletin has no description...
ECHO-4C35-FCD8-CA55
Bulletin has no description...
ECHO-1814-DA4F-7983
Bulletin has no description...
ECHO-B09D-C689-B716
Bulletin has no description...
ECHO-70DF-01DF-0CB2
Bulletin has no description...
ECHO-2426-223E-D79F
Bulletin has no description...
ECHO-6280-5637-DD2F
Bulletin has no description...